RufRoot: 233 agent tools exposed without authentication; a single HTTP request was enough

The Ruflo agent orchestration platform left its MCP bridge open to the network. Maximum CVSS score of 10; remote command execution without any access tokens.

Named RufRoot by Noma Security researchers who discovered it, the CVE-2026-59726 flaw affects Ruflo, an open-source AI agent orchestration platform. Its CVSS score reaches the absolute maximum of 10. The reason: in the docker-compose deployment provided by default, the Model Context Protocol bridge attached to port 3001 on all network interfaces, without any authentication checks.

This bridge exposes 233 tools, including shell command execution and database operations. A single unauthenticated HTTP POST request, invoking the tools/call method on the terminal execution tool, would open a shell in the container. From there, an attacker could retrieve API keys from model providers, harvest user conversations, corrupt learning patterns stored in AgentDB, install persistent backdoors, and turn swarms of agents against their owner.

The fix is in version 3.16.3, released on June 30, 2026: the MCP bridge now only attaches to the local interface. Operators of an earlier version are advised to rotate all of their API keys, audit AgentDB for malicious entries, and close ports 3001 and 27017 on their firewall.